metasploit-framework/modules/auxiliary/scanner/mysql/mysql_version.rb

83 lines
2.0 KiB
Ruby
Raw Normal View History

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
2016-03-08 13:02:44 +00:00
class MetasploitModule < Msf::Auxiliary
2013-08-30 21:28:54 +00:00
include Msf::Exploit::Remote::Tcp
include Msf::Auxiliary::Scanner
include Msf::Auxiliary::Report
2013-08-30 21:28:54 +00:00
def initialize
super(
'Name' => 'MySQL Server Version Enumeration',
'Description' => %q{
Enumerates the version of MySQL servers
},
'Author' => 'kris katterjohn',
'License' => MSF_LICENSE
)
2013-08-30 21:28:54 +00:00
register_options([
Opt::RPORT(3306)
])
end
2013-08-30 21:28:54 +00:00
# Based on my mysql-info NSE script
def run_host(ip)
begin
s = connect(false)
data = s.get_once(-1,10)
disconnect(s)
if data.nil?
print_error "The connection to #{rhost}:#{rport} timed out"
return
end
rescue ::Rex::ConnectionError, ::EOFError
vprint_error("#{rhost}:#{rport} - Connection failed")
return
rescue ::Exception
print_error("Error: #{$!}")
return
end
2013-08-30 21:28:54 +00:00
offset = 0
2013-08-30 21:28:54 +00:00
l0, l1, l2 = data[offset, 3].unpack('CCC')
length = l0 | (l1 << 8) | (l2 << 16)
2013-08-30 21:28:54 +00:00
# Read a bad amount of data
return if length != (data.length - 4)
2013-08-30 21:28:54 +00:00
offset += 4
2013-08-30 21:28:54 +00:00
proto = data[offset, 1].unpack('C')[0]
2013-08-30 21:28:54 +00:00
# Application-level error condition
if proto == 255
offset += 2
err_msg = Rex::Text.to_hex_ascii(data[offset..-1].to_s)
print_status("#{rhost}:#{rport} is running MySQL, but responds with an error: #{err_msg}")
report_service(
:host => rhost,
:port => rport,
:name => "mysql",
:info => "Error: #{err_msg}"
)
else
offset += 1
version = data[offset..-1].unpack('Z*')[0]
print_status("#{rhost}:#{rport} is running MySQL #{version} (protocol #{proto})")
report_service(
:host => rhost,
:port => rport,
:name => "mysql",
:info => version
)
end
end
end